FPF Submits Comments to Inform Colorado Automated Decision-Making (ADM) Act Rulemaking
Co-authored by Michelle Roitgarts, U.S. Legislation Legal Intern
On October 26, 2026, the Future of Privacy Forum (FPF) submitted comments in response to the Colorado Department of Law’s (the Department’s) formal rulemaking process for the Colorado Automated Decision-Making Technology Act (SB 26-189). FPF’s comments address the Department’s October 6 interim draft rules, focusing on clarifying the scope of covered automated decision-making technology (ADMT) and aligning developer disclosure requirements with deployer obligations. FPF’s recommendations seek to promote interoperability, clarify compliance obligations, and support meaningful transparency and human oversight in consequential decisions.
Enacted in May 2026, SB 26-189 repeals and replaces the Colorado AI Act (SB 24-205), establishing new requirements for developers and deployers of ADMT used to materially influence consequential decisions. The law requires developers to provide a general statement concerning covered ADMT, including its intended uses and known limitations, and requires deployers to provide consumers with notices and explanations regarding the technology’s use in consequential decisions. It also establishes consumer rights to access and correct certain personal data and request meaningful human review following adverse consequential decisions.
The law takes effect January 1, 2027. In August 2026, the Department initiated a formal rulemaking process to clarify and implement SB 26-189 and the Colorado Chatbot Safety Act (HB 26-1263). Following an initial round of public comments, the Department released an updated interim draft on October 6, 2026. The draft addresses several aspects of the ADMT Act, including the scope of covered technologies, developer documentation requirements, deployer transparency obligations, and consumer rights.
FPF seeks to support balanced, informed public policy and equip regulators with the resources and tools needed to craft effective regulation. Building on FPF’s Updated Best Practices for AI and Workplace Assessment Technologies, FPF offered two recommendations for the Department’s consideration:
- Simplify the considerations for assessing covered ADMT by removing two of six proposed factors, promoting interoperability with California’s ADMT regulations and Colorado’s existing Privacy Act regulations while preserving a meaningful inquiry into human involvement in consequential decisions.
- Further align developer disclosure requirements with deployer obligations to consumers, ensuring that deployers receive the information necessary to meet their transparency and compliance responsibilities.
1. Simplify the Scope of Covered ADMT
The Department’s interim draft proposes six considerations for determining whether an ADMT output was a de minimis factor in a consequential decision, which informs whether the technology materially influenced that decision and falls within the scope of the law.
FPF recommends retaining the first four considerations, which center human involvement, including whether a decision-maker reviewed the ADMT output, independently analyzed other relevant information, possessed the necessary subject-matter understanding, and had authority to make or change the decision. These considerations are consistent with California’s ADMT regulations and Colorado’s existing Privacy Act regulations, both of which emphasize sufficient human participation in automated decision-making.
However, FPF recommends removing the final two considerations, which focus on organizational policies and the volume, type, or complexity of personal data processing. Rather than directly assessing the extent of human involvement, these considerations address the circumstances surrounding that involvement.
FPF recommends treating organizational policies and related documentation as supporting evidence of meaningful human involvement, consistent with the framework in proposed Rule 6.1(B). Further, the complexity of personal data processing does not necessarily establish whether an ADMT output itself materially influenced a consequential decision, particularly where a human decision-maker exercises independent judgment. Since the statutory definition of ADMT already includes the processing of personal data, introducing the complexity of that processing risks creating a duplicative inquiry that shifts the focus away from reliable measures of actual human involvement.
2. Align Developer Disclosures with Deployer Obligations to Consumers
FPF also recommends that the Department further clarify developer disclosure requirements to ensure that deployers receive the information necessary to meet their obligations to consumers.
The interim draft requires developers to provide documentation concerning covered ADMT, including its intended uses, known limitations, and known risks. However, gaps between the information developers must provide and the information deployers must disclose to consumers may leave deployers responsible for explaining aspects of a system they cannot independently assess.
Drawing on FPF’s Updated Best Practices, the comments recommend that the Department:
- Tie developer documentation to deployer obligations by requiring developers to provide information sufficient to enable deployers to meet their statutory responsibilities, to the extent that information is within the developer’s knowledge.
- Clarify the meaning of “known limitations” and “known risks” to include relevant performance limitations, intended user populations, and reasonably foreseeable risks identified through developer testing.
- Clarify ongoing disclosure obligations by specifying when developers should notify deployers of material updates, changes in intended use, or newly identified material risks.
- Encourage standardized documentation formats, such as model cards and system cards, to facilitate consistent communication of technical information between developers and deployers.
Read the full comments here.
